CVE-2026-23278

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nf_tables component. This vulnerability occurs during transaction processing when the system incorrectly handles multiple pending catchall elements, particularly when the associated map is being removed. This can lead to a kernel warning and system instability, potentially causing a Denial of Service (DoS) for the affected system.

nf_tables transaction processing can involve more than one catchall element at the same time such as one live element and one pending element from a new batch. When a map that holds catchall elements is being removed the code must toggle all catchall elements. The prior logic stopped after the first viable candidate which could leave additional pending catchall elements in an inconsistent state and later trigger a warning in nft_data_release during abort cleanup. The issue is not directly network reachable and it is triggered by control plane configuration changes rather than packet traffic. Impact is primarily denial of service in environments that treat WARN as fatal or that cannot tolerate repeated abort warnings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.